fix: scope trigger overrides and location listings to node coverage

trigger.toggle and sensor.reset_cursor are now authorized on every node
the trigger's current job or group writes, all or nothing, as job.run
is. A role covering only some of those nodes can no longer pause or
reset the trigger.

The catalog, statistics and run listings span the whole location, so
they now need view coverage of every node in the current publication.
Partial coverage is denied and names the missing nodes; results are
never filtered.

Validated: the native role tests (15, on SQLite and PostgreSQL),
deliberate breaks of both fixes, the full orchestration native suite
(106), 13 installed publication tests and make check-ci.

Author: kvlonge

crates/sqlbuild-orchestration/src/authorization/main/authorize_listing.rs

@@ -0,0 +1,34 @@
+//! A location-wide listing needs view coverage of every node in the current snapshot; it is never filtered.
+
+use std::collections::BTreeSet;
+
+use uuid::Uuid;
+
+use crate::authorization::main::authorize_session::authorize_session;
+use crate::credentials::models::{Action, AuditContext, DefaultRole, PermissionScope};
+use crate::store::errors::ControlError;
+use crate::store::main::query::query;
+use crate::store::models::{ControlTransaction, Parameter};
+
+pub(crate) async fn authorize_listing(
+    transaction: ControlTransaction,
+    credentials: (&AuditContext, (&str, &str)),
+    (location_id, target): (Uuid, &str),
+    default_role: DefaultRole,
+) -> Result<(ControlTransaction, AuditContext), ControlError> {
+    let (transaction, rows) = query(transaction,
+        "SELECT n.node_key FROM sqb_snapshot_nodes n JOIN sqb_current_snapshots c ON c.snapshot_id=n.snapshot_id \
+         WHERE c.location_id=$1 AND c.target=$2",
+        vec![Parameter::Id(location_id), Parameter::Text(target.into())]).await?;
+    let mut nodes: BTreeSet<String> = BTreeSet::new();
+    for row in &rows {
+        nodes.insert(row["node_key"].as_str().unwrap_or_default().into());
+    }
+    let scope = PermissionScope {
+        action: Action::View,
+        location_id: Some(location_id),
+        target: Some(target.into()),
+        nodes,
+    };
+    authorize_session(transaction, credentials, &scope, default_role).await
+}

crates/sqlbuild-orchestration/src/authorization/main/mod.rs

@@ -1,4 +1,5 @@
 pub mod assign_builtin_role;
+pub(crate) mod authorize_listing;
 pub(crate) mod authorize_session;
 pub mod bootstrap_user;
 pub mod change_administrator;

crates/sqlbuild-orchestration/src/declarations/_helpers/mod.rs

@@ -3,4 +3,5 @@ pub(crate) mod documents;
 pub(crate) mod operator_change;
 pub(crate) mod operator_state;
 pub(crate) mod publication;
+pub(crate) mod trigger_scope;
 pub(crate) mod trigger_state;

crates/sqlbuild-orchestration/src/declarations/_helpers/trigger_scope.rs

@@ -0,0 +1,54 @@
+//! A trigger override's permission scope is every node the trigger's current job or group writes.
+
+use uuid::Uuid;
+
+use crate::credentials::models::{Action, AuditContext, PermissionScope};
+use crate::declarations::models::{TriggerChange, TriggerChangeRequest};
+use crate::runs::main::frozen_job_request::frozen_job_request;
+use crate::runs::models::JobRunRequest;
+use crate::snapshots::main::job_write_set::job_write_set;
+use crate::store::errors::ControlError;
+use crate::store::main::query::query;
+use crate::store::models::{ControlTransaction, Parameter};
+
+/// A group's scope is its frozen selection's write set, which covers every child's write set.
+pub(crate) async fn trigger_scope(
+    transaction: ControlTransaction,
+    context: &AuditContext,
+    request: &TriggerChangeRequest,
+) -> Result<(ControlTransaction, PermissionScope), ControlError> {
+    let (transaction, rows) = query(transaction,
+        "SELECT location_id,target,job_key FROM sqb_triggers WHERE trigger_id=$1 AND removed_in_snapshot_id IS NULL",
+        vec![Parameter::Id(request.trigger_id)]).await?;
+    let row = rows
+        .first()
+        .ok_or_else(|| ControlError::Invalid("current trigger not found".into()))?;
+    let job = JobRunRequest {
+        run_id: Uuid::nil(),
+        location_id: serde_json::from_value(row["location_id"].clone())
+            .map_err(|error| ControlError::Invalid(error.to_string()))?,
+        target: row["target"].as_str().unwrap_or_default().into(),
+        job_key: row["job_key"].as_str().unwrap_or_default().into(),
+        reason: request.reason.clone(),
+        priority: 0,
+        window: None,
+    };
+    let (transaction, frozen) = frozen_job_request(transaction, context, &job).await?;
+    let (transaction, nodes) =
+        job_write_set(transaction, frozen.snapshot_id, &frozen.selection).await?;
+    let action = match request.change {
+        TriggerChange::Enable | TriggerChange::Pause | TriggerChange::ResetDefault => {
+            Action::TriggerToggle
+        }
+        TriggerChange::SetCursor { .. } | TriggerChange::ResetCursor => Action::SensorResetCursor,
+    };
+    Ok((
+        transaction,
+        PermissionScope {
+            action,
+            location_id: Some(job.location_id),
+            target: Some(job.target),
+            nodes,
+        },
+    ))
+}

crates/sqlbuild-orchestration/src/declarations/main/change_person_trigger.rs

@@ -1,42 +1,28 @@
-//! Resolve a trigger's real location before authorizing an authenticated runtime override.
+//! A trigger override needs its permission on every node the trigger's current job or group writes.
 
 use serde_json::json;
 
 use crate::authorization::main::authorize_session::authorize_session;
 use crate::authorization::main::deny_authorization::deny;
-use crate::credentials::models::{Action, AuditContext, DefaultRole, PermissionScope};
+use crate::credentials::models::{AuditContext, DefaultRole};
 use crate::declarations::_helpers::operator_change::change_trigger_in;
-use crate::declarations::models::{TriggerChange, TriggerChangeRequest};
+use crate::declarations::_helpers::trigger_scope::trigger_scope;
+use crate::declarations::models::TriggerChangeRequest;
 use crate::store::errors::ControlError;
-use crate::store::main::{begin::begin, commit::commit, query::query};
-use crate::store::models::{ControlStore, Parameter, TransactionMode};
+use crate::store::main::{begin::begin, commit::commit};
+use crate::store::models::{ControlStore, TransactionMode};
 
 pub async fn change_person_trigger(
     store: &ControlStore,
     (context, credentials): (&AuditContext, (&str, &str)),
     request: &TriggerChangeRequest,
 ) -> Result<bool, ControlError> {
-    let (transaction, rows) = query(begin(store, TransactionMode::Write).await?,
-        "SELECT location_id,target FROM sqb_triggers WHERE trigger_id=$1 AND removed_in_snapshot_id IS NULL",
-        vec![Parameter::Id(request.trigger_id)]).await?;
-    let row = rows
-        .first()
-        .ok_or_else(|| ControlError::Invalid("current trigger not found".into()))?;
-    let scope = PermissionScope {
-        action: match request.change {
-            TriggerChange::Enable | TriggerChange::Pause | TriggerChange::ResetDefault => {
-                Action::TriggerToggle
-            }
-            TriggerChange::SetCursor { .. } | TriggerChange::ResetCursor => {
-                Action::SensorResetCursor
-            }
-        },
-        location_id: serde_json::from_value(row["location_id"].clone())
-            .map_err(|error| ControlError::Invalid(error.to_string()))?,
-        target: serde_json::from_value(row["target"].clone())
-            .map_err(|error| ControlError::Invalid(error.to_string()))?,
-        nodes: Default::default(),
-    };
+    let (transaction, scope) = trigger_scope(
+        begin(store, TransactionMode::Write).await?,
+        context,
+        request,
+    )
+    .await?;
     let (transaction, context) = authorize_session(
         transaction,
         (context, credentials),

crates/sqlbuild-orchestration/src/runs/main/list_person_runs.rs

@@ -2,8 +2,8 @@
 
 use uuid::Uuid;
 
-use crate::authorization::main::authorize_session::authorize_session;
-use crate::credentials::models::{Action, AuditContext, DefaultRole, PermissionScope};
+use crate::authorization::main::authorize_listing::authorize_listing;
+use crate::credentials::models::{AuditContext, DefaultRole};
 use crate::runs::_helpers::lifecycle::reads::list_runs_in;
 use crate::runs::models::RunRecord;
 use crate::store::errors::ControlError;
@@ -16,15 +16,10 @@ pub async fn list_person_runs(
     (location_id, target, limit): (Uuid, &str, u32),
     default_role: DefaultRole,
 ) -> Result<Vec<RunRecord>, ControlError> {
-    let (transaction, _) = authorize_session(
+    let (transaction, _) = authorize_listing(
         begin(store, TransactionMode::Write).await?,
         (context, credentials),
-        &PermissionScope {
-            action: Action::View,
-            location_id: Some(location_id),
-            target: Some(target.into()),
-            nodes: Default::default(),
-        },
+        (location_id, target),
         default_role,
     )
     .await?;

crates/sqlbuild-orchestration/src/warehouse_metadata/main/read_person_catalog.rs

@@ -2,12 +2,12 @@
 
 use uuid::Uuid;
 
-use crate::credentials::models::{Action, AuditContext, DefaultRole, PermissionScope};
+use crate::authorization::main::authorize_listing::authorize_listing;
+use crate::credentials::models::{AuditContext, DefaultRole};
 use crate::store::errors::ControlError;
-use crate::store::main::commit::commit;
-use crate::store::models::ControlStore;
+use crate::store::main::{begin::begin, commit::commit};
+use crate::store::models::{ControlStore, TransactionMode};
 use crate::warehouse_metadata::_helpers::catalog::read_catalog_page;
-use crate::warehouse_metadata::_helpers::person_reads::begin_view;
 use crate::warehouse_metadata::models::{CatalogPage, CatalogQuery};
 
 pub async fn read_person_catalog(
@@ -16,15 +16,10 @@ pub async fn read_person_catalog(
     (location_id, target, options): (Uuid, &str, &CatalogQuery),
     default_role: DefaultRole,
 ) -> Result<CatalogPage, ControlError> {
-    let transaction = begin_view(
-        store,
+    let (transaction, _) = authorize_listing(
+        begin(store, TransactionMode::Write).await?,
         (context, credentials),
-        &PermissionScope {
-            action: Action::View,
-            location_id: Some(location_id),
-            target: Some(target.into()),
-            nodes: Default::default(),
-        },
+        (location_id, target),
         default_role,
     )
     .await?;

crates/sqlbuild-orchestration/src/warehouse_metadata/main/read_person_statistics.rs

@@ -2,11 +2,11 @@
 
 use uuid::Uuid;
 
-use crate::credentials::models::{Action, AuditContext, DefaultRole, PermissionScope};
+use crate::authorization::main::authorize_listing::authorize_listing;
+use crate::credentials::models::{AuditContext, DefaultRole};
 use crate::store::errors::ControlError;
-use crate::store::main::commit::commit;
-use crate::store::models::ControlStore;
-use crate::warehouse_metadata::_helpers::person_reads::begin_view;
+use crate::store::main::{begin::begin, commit::commit};
+use crate::store::models::{ControlStore, TransactionMode};
 use crate::warehouse_metadata::_helpers::statistics::read_statistics_page;
 use crate::warehouse_metadata::models::{StatisticsPage, StatisticsQuery, StatisticsRetention};
 
@@ -16,15 +16,10 @@ pub async fn read_person_statistics(
     (location_id, target, options): (Uuid, &str, &StatisticsQuery),
     (default_role, retention): (DefaultRole, StatisticsRetention),
 ) -> Result<StatisticsPage, ControlError> {
-    let transaction = begin_view(
-        store,
+    let (transaction, _) = authorize_listing(
+        begin(store, TransactionMode::Write).await?,
         (context, credentials),
-        &PermissionScope {
-            action: Action::View,
-            location_id: Some(location_id),
-            target: Some(target.into()),
-            nodes: Default::default(),
-        },
+        (location_id, target),
         default_role,
     )
     .await?;